CVE-2025-4127 is a stored cross-site scripting vulnerability (CWE-79) in the WP SEO Structured Data Schema plugin for WordPress. The issue exists in the handling of the 'Price Range' parameter, where input is not properly sanitized or escaped before being rendered in the plugin settings page. Authenticated attackers with Contributor-level privileges or higher can exploit this to inject arbitrary JavaScript that executes in the context of an administrator's browser, potentially leading to session hijacking or other malicious actions. The vulnerability affects all versions up to 2.7.11. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial confidentiality and integrity impact.

An attacker with Contributor-level or higher access can inject persistent malicious scripts via the 'Price Range' parameter. These scripts execute when an administrator accesses the plugin settings page, potentially allowing the attacker to steal admin session tokens or perform actions with the administrator's privileges. The vulnerability does not impact availability. There are no known active exploits reported.

No official patch or remediation guidance is currently available from the vendor. Users should restrict Contributor-level access to trusted users and monitor for suspicious activity. Administrators should avoid accessing the plugin settings page from untrusted environments until a fix is released. Check the vendor advisory regularly for updates regarding patches or official fixes.